ransack 5.0.1 → 5.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 488db32f12e0902a6194cc3f5d0b4e08676b8533302f00a2bd30739f0bead9de
-  data.tar.gz: f884ce36bbb02c25a58c2293f75d1147a790075242b11fec6a24b487a1d39f19
+  metadata.gz: bb028d041bbb2d5f57c32e8846cd1db041e232bec4a96e3f0d9d7d271aa44235
+  data.tar.gz: 66193a18248b27e47ae7271acbf8fa76772f4583b1ec99c7d80f8cf88811ce9d
 SHA512:
-  metadata.gz: eb8990b59a5d2c06eda4851c80682628f3f818cfc9d6a8e6a68c870a7e69d36e97406bc4606e0234c8a1325e8bde143930e6849eb3afbf834a707c7fa89063a6
-  data.tar.gz: 97b4c79957abc27206b8a0de0a681a13904a0e80de942c8fd0501edc03d56c166bab15f456a6c5e1abecf2f0f2a142e854b2c01509db0a85da41b258b2b7a16d
+  metadata.gz: 1b0e855e1a62829faf572273b65947b36ad57452826c10ccf8dc12f2f3f009600c1eef8e3789a1acca549d09711dd09f58fa38c72636e506ac4ca135e36bf324
+  data.tar.gz: a8ac8fca894d3c2f842bfd29bd99e78c801453b0f692f6c47f9786fc0ac0cb404d03f6ec7c8d773ae2cbcfd4c084cdf6b203163238e0326361084517bfe64f1d

data/lib/ransack/adapters/active_record/context.rb

@@ -64,6 +64,8 @@ module Ransack
         end
 
         def attribute_method?(str, klass = @klass)
+          return false unless key_within_depth_limit?(str)
+
           exists = false
           if ransackable_attribute?(str, klass) ||
              ransortable_attribute?(str, klass)
@@ -238,6 +240,8 @@ module Ransack
         end
 
         def get_parent_and_attribute_name(str, parent = @base)
+          return [parent, nil] unless key_within_depth_limit?(str)
+
           attr_name = nil
 
           if ransackable_attribute?(str, klassify(parent)) ||

data/lib/ransack/constants.rb

@@ -50,6 +50,15 @@ module Ransack
 
     DISTINCT = 'DISTINCT '.freeze
 
+    # The most `_`-separated segments a single condition or sort key may have
+    # before Ransack rejects it as invalid instead of parsing it. Working out
+    # whether a key is an attribute, an `_and_`/`_or_` compound or a path
+    # through associations is superlinear in this count, and the key comes
+    # straight from the query string, so an unbounded one is a CPU-exhaustion
+    # denial of service (GHSA-j3f8-w227-4hh8). No real search key is this
+    # long: OR-ing every column of a very wide table stays well under it.
+    MAX_KEY_DEPTH = 200
+
     DERIVED_PREDICATES = [
       [CONT, {
         arel_predicate: 'matches'.freeze,

data/lib/ransack/context.rb

@@ -52,6 +52,15 @@ module Ransack
       @base = @join_dependency.instance_variable_get(:@join_root)
     end
 
+    # False when a key has more `_`-separated segments than Ransack will
+    # parse. The attribute / association / predicate parsing that follows is
+    # superlinear in the segment count and the key is attacker-controlled, so
+    # an over-long key is treated as unknown rather than parsed
+    # (GHSA-j3f8-w227-4hh8).
+    def key_within_depth_limit?(key)
+      key.to_s.count(Constants::UNDERSCORE) <= Constants::MAX_KEY_DEPTH
+    end
+
     def bind_pair_for(key)
       @bind_pairs ||= {}
 
@@ -137,6 +146,8 @@ module Ransack
     end
 
     def association_path(str, base = @base)
+      return ''.freeze unless key_within_depth_limit?(str)
+
       base = klassify(base)
       str ||= ''.freeze
       path = []

data/lib/ransack/helpers/form_helper.rb

@@ -162,6 +162,17 @@ module Ransack
         end
 
       class SortLink
+        # Keys url_for reads as instructions for building the link, not as
+        # query params. The request's params are carried over into the link,
+        # so a crafted query string could otherwise change its scheme, host,
+        # port, path prefix or route (GHSA-58rx-96gf-w92x). Userinfo needs
+        # :user and :password together, so dropping :password is enough to
+        # keep a ?user= filter.
+        RESERVED_URL_OPTIONS = (
+          ActionDispatch::Routing::RouteSet::RESERVED_OPTIONS +
+          %i[password use_route _recall]
+        ).freeze
+
         def initialize(search, attribute, args, params)
           @search         = search
           @params         = parameters_hash(params)
@@ -195,7 +206,7 @@ module Ransack
         end
 
         def url_options
-          @params.except(:host).merge(
+          @params.except(*RESERVED_URL_OPTIONS).merge(
             @options.except(:class, :data, :host).merge(
               @search.context.search_key => search_and_sort_params))
         end
@@ -218,12 +229,11 @@ module Ransack
 
         private
 
+          # Indifferent access, so RESERVED_URL_OPTIONS also matches the string
+          # keys of a plain Hash.
           def parameters_hash(params)
-            if params.respond_to?(:to_unsafe_h)
-              params.to_unsafe_h
-            else
-              params
-            end
+            params = params.to_unsafe_h if params.respond_to?(:to_unsafe_h)
+            params.with_indifferent_access
           end
 
           def extract_sort_fields_and_mutate_args!(args)

data/lib/ransack/nodes/grouping.rb

@@ -126,6 +126,8 @@ module Ransack
       end
 
       def attribute_method?(name)
+        return false unless @context.key_within_depth_limit?(name)
+
         stripped_name = strip_predicate_and_index(name)
         return true if @context.attribute_method?(stripped_name) ||
                        @context.attribute_method?(name)

data/lib/ransack/version.rb

@@ -1,3 +1,3 @@
 module Ransack
-  VERSION = '5.0.1'
+  VERSION = '5.0.3'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ransack
 version: !ruby/object:Gem::Version
-  version: 5.0.1
+  version: 5.0.3
 platform: ruby
 authors:
 - Ernie Miller